Self-Improvement System

• Outcome: Review
• Latest audit: Sep 12, 2026 · 5:08 AM UTC
• Version: 1.2.0

Overview

The skill is a coherent self-improvement memory system, but it gives mutable local files broad authority to shape future agent behavior automatically.

Install only if you are comfortable with the agent maintaining local behavior files that can affect future sessions. Review or isolate soul.md, lessons.md, playbook.md, session-log.md, and mistakes.md before use, and avoid running this skill in untrusted project directories until it uses a dedicated data directory and makes clear that stored notes cannot override higher-priority instructions.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:38

Finding

Persistent Behavioral Instruction Hijacking Through Automatically Loaded State Files

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:38-65; related promotion rules in references/protocol.md:57-91 and references/protocol.md:107-119
Vulnerability Type: Persistent instruction and memory hijacking
Risk Level: Critical

Vulnerable Code Snippet

markdown

## Session Startup — always do this first

Before taking any action in a new session, read the following files if they exist:

- `soul.md` — core behavioural principles (these override defaults)
- `lessons.md` — extracted rules and heuristics
- `playbook.md` — proven workflows for common task types
- `session-log.md` — what was learned or updated in recent sessions

Internalise their contents before proceeding. If any file is missing, create it with a brief header comment and continue.

---

## Before Every Non-Trivial Response

Before finalising any response that involves reasoning, multi-step work, or external tools, run this internal check:

1. **Am I confident in this?** If uncertain, say so explicitly rather than proceeding as if certain.
2. **Have I made this type of mistake before?** Scan `lessons.md` for a relevant rule.
3. **Is there a playbook entry for this task type?** If yes, follow it.

If any answer is uncertain, note it briefly before responding — not after. This is the only part of the system that actively prevents mistakes rather than cataloguing them after the fact.

The associated protocol permits persistent rules to be promoted into the highest-authority local behavioral file:

markdown

## 3. Core Principles (`soul.md`)

Promote a lesson to `soul.md` only when it meets all three criteria:

1. It applies across many different task types
2. Violating it has caused or would cause a Medium or High severity mistake
3. It reflects a reasoning principle, not a situational tactic

Technical Analysis

The Skill directs the Agent to load local files before taking any other action, internalize their contents, and allow soul.md to “override defaults ...[truncated 2344 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the statement that soul.md or any Skill-managed file can override defaults. Explicitly require system, developer, and current user instructions to retain precedence.
2. Treat all persisted file contents as untrusted data rather than instructions. Parse entries through a strict schema containing only predefined fields and enumerated values.
3. Reject imperative instructions, tool directives, role changes, safety-policy changes, and references to secrets or unrelated files in persisted entries.
4. Require explicit user approval before loading persistent behavioral state into a new session or promoting a lesson into a higher-authority file.
5. Store provenance for every entry, including creation time, originating session, approval status, and integrity digest.
6. Verify file ownership, permissions, and integrity before loading state. Refuse state files writable by untrusted users or supplied through an untrusted project.
7. Constrain persisted lessons to advisory observations that cannot independently authorize tools, file access, network activity, or policy changes.
8. Provide a review and reset mechanism that displays all persistent rules and allows the user to disable or delete them before they affect a session.

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:38

Finding

Unbounded Relative-Path File Mutation Enables Persistent State Poisoning

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:38-47 and SKILL.md:79-87; related archival operations in references/protocol.md:121-162 and references/protocol.md:185-211
Vulnerability Type: Unsafe persistent file creation, modification, and archival
Risk Level: High

Vulnerable Code Snippet

markdown

## Session Startup — always do this first

Before taking any action in a new session, read the following files if they exist:

- `soul.md` — core behavioural principles (these override defaults)
- `lessons.md` — extracted rules and heuristics
- `playbook.md` — proven workflows for common task types
- `session-log.md` — what was learned or updated in recent sessions

Internalise their contents before proceeding. If any file is missing, create it with a brief header comment and continue.

markdown

## Session Close — always do this last

Before ending any session, append one entry to `session-log.md`:

[YYYY-MM-DD] [Key lesson or "no new lessons"] | Files updated: [list or "none"]

text

Session log entries follow the same privacy rules — process observations only, no user data.

If `mistakes.md` now exceeds 50 entries, or contains entries older than 90 days, move the oldest entries to `archive/mistakes-[year].md` before closing. Keep only active entries and any `[pattern-rule]` or High-severity entries in the main file.

The protocol additionally mandates directory and file creation:

markdown

Create the archive directory if it does not exist. Name files by year: `archive/mistakes-2025.md`, `archive/mistakes-2026.md`, etc. Archived entries carry the same privacy standards as active ones.

Technical Analysis

The Skill mandates creation, append, update, move, and archive operations using relative paths such as soul.md, session-log.md, mistakes.md, and archive/. It does not define a canonical storage root or require validation of the resolved destination.

No controls are specified for:

• Canonicalizing path ...[truncated 2130 chars]

Remediation

View remediation

Remediation Suggestions

1. Store all state under a dedicated, explicitly configured data directory rather than the current working directory.
2. Resolve every destination to a canonical path and verify that it remains beneath the approved storage root before reading, writing, moving, or creating it.
3. Reject symbolic links and other indirect filesystem objects. Where supported, open files with no-follow semantics and verify the file type after opening.
4. Validate ownership and permissions for the storage root and every existing state file. Refuse files writable by untrusted principals.
5. Create files and directories with restrictive permissions and avoid inheriting overly broad defaults.
6. Require explicit user consent before the first persistent write and provide a mode that performs self-audits without modifying the filesystem.
7. Use atomic write patterns with securely created temporary files, synchronization, and rename operations to prevent corruption or race-condition substitution.
8. Namespace filenames to avoid collisions with ordinary project files, and never overwrite an existing non-state file.
9. Keep persistent entries declarative and schema-validated so that a filesystem write cannot become an instruction-injection mechanism during the next session.
10. Log resolved destinations and rejected path-validation attempts without including user data or secrets.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill is configured to auto-trigger not only on explicit user requests but also at session start, periodically, and whenever the agent 'detects' an error. That broad activation scope can cause the skill to run without clear user intent, leading to unsolicited file reads/writes and persistent behavior changes based on internal heuristics rather than an explicit command.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.